{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:91b5f136-8b72-503f-983c-fad81bd166f9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "httpclient",
      "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1",
      "type": "library",
      "group": "org.apache.httpcomponents",
      "bom-ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1",
      "version": "4.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "httpclient",
            "purl": "pkg:maven/org.apache.httpcomponents/httpclient@4.4",
            "type": "library",
            "group": "org.apache.httpcomponents",
            "version": "4.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2011-1498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:468eb951-03a6-510d-8695-0606b4873ef6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2011-1498 does not affect version 4.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2011-1498 affects Apache HttpClient versions before 4.1.1, where Proxy-Authorization headers were incorrectly sent to origin servers when using tunneled connections through authenticating proxies. The target repository is version 4.4-tuxcare.1, which already contains the upstream fix (commit a57275659) that was shipped in the original Apache HttpComponents Client 4.4 release. The fix is pre...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-6153",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b1354fc4-378c-5684-8ed8-09171b5ee048",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-6153 does not affect version 4.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2012-6153 affects versions before 4.2.3. Target version 4.4 shipped with a complete rewrite of SSL hostname verification introduced by Apache upstream. The vulnerable CN extraction logic (using indexOf(\"CN=\") which incorrectly matched \"CN=\" in non-CN fields like \"OU=CN=evil.com\") was replaced with secure JNDI LdapName/Rdn parsing in DefaultHostnameVerifier.extractCN(). The deprecated Abstra...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-4366",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:12a9286f-0f29-5151-9052-01061f72f207",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4366 does not affect version 4.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 CVE-2013-4366 affects Apache HttpClient 4.3.x before 4.3.1, where HttpClientBuilder does not ensure X509HostnameVerifier is not null. Version 4.4 already contains the upstream Apache fix (commit 08140864e by olegk@apache.org, 2013-10-02) that adds a null check at lines 899-902, ensuring HostnameVerifier defaults to DefaultHostnameVerifier if not explicitly set. The vulnerable pattern (missing n...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-3577",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f911007d-8609-5d77-9bbf-f6ac4c4a174c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3577 does not affect version 4.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Target version 4.4 is NOT affected by CVE-2014-3577. The vulnerability affects versions before 4.3.5. The fix was already included in the upstream Apache HttpComponents Client 4.4 release (February 2015) before TuxCare onboarded it. The target uses DefaultHostnameVerifier.extractCN() which implements proper LDAP Distinguished Name parsing via LdapName/Rdn, preventing the substring-match vulnera...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5262",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ae5fab2b-ad53-5960-8a7d-3bc7e6c52979",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5262 does not affect version 4.4-tuxcare.1 of org.apache.httpcomponents:httpclient. not_affected \u2014 Apache HttpComponents HttpClient 4.4 is not affected by CVE-2015-5262. The vulnerability (missing socket timeout during SSL handshake causing potential DoS via indefinite hang) was fixed in the upstream Apache release by commit 1d09a8308 (September 2014), before TuxCare onboarded version 4.4 in commit 2de730e75. Both SSLConnectionSocketFactory.java (lines 332-334) and the deprecated SSLSocketFa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:076f8cf5-7514-5a9b-8d03-94df158e6685",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13956 is fixed in version 4.4-tuxcare.1 of org.apache.httpcomponents:httpclient."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.4-tuxcare.1"
    }
  ]
}